User-plane admin

Platform credentials and the audit trail for the provider_admin role, over /v1/admin.

The user-plane admin group /v1/admin/* serves humans holding the provider_admin role (the auditor role reads the audit trail only). It manages the platform ownership level — the shared fallback keys — with the same contract as Personal Credentials: the server sets owner_type=platform, owner_id=null, and every read returns masks.

Platform credentials

POST /v1/admin/platform-credentials, plus the standard list/get/PATCH/make-default/disable/enable/DELETE family. The platform default is what resolve serves to any user whose personal and organization levels came up empty — which makes two operations unusually loud:

• Disabling the platform default cuts off every user relying on the fallback, immediately.
• make-default switches the key the whole platform runs on.

Both are ordinary, versioned, audited calls — just know their blast radius.

GET /v1/admin/providers/{provider_code}/credential-usage counts credentials per level (active_user, disabled_user, active_organization, disabled_organization, active_platform, soft_deleted) and answers can_remove_from_catalog — true only when no live credential references the provider, the precondition for dropping it from the catalog YAML.

Audit trail

GET /v1/admin/audit-events — the same trail described in Audit Events, readable by provider_admin and auditor.